[Idr] 答复: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

"Xialiang (Frank, Network Standard & Patent Dept)" <frank.xialiang@huawei.com> Tue, 02 April 2019 01:52 UTC

Return-Path: <frank.xialiang@huawei.com>
X-Original-To: idr@ietfa.amsl.com
Delivered-To: idr@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 3D7B412006E; Mon, 1 Apr 2019 18:52:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.198
X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id 8tOb8C6DZOdp; Mon, 1 Apr 2019 18:52:31 -0700 (PDT)
Received: from huawei.com (lhrrgout.huawei.com []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAEF8120021; Mon, 1 Apr 2019 18:52:30 -0700 (PDT)
Received: from lhreml704-cah.china.huawei.com (unknown []) by Forcepoint Email with ESMTP id D3EE0E11913C59382BE6; Tue, 2 Apr 2019 02:52:28 +0100 (IST)
Received: from DGGEMM423-HUB.china.huawei.com ( by lhreml704-cah.china.huawei.com ( with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 2 Apr 2019 02:52:28 +0100
Received: from DGGEMM511-MBX.china.huawei.com ([]) by dggemm423-hub.china.huawei.com ([]) with mapi id 14.03.0415.000; Tue, 2 Apr 2019 09:52:16 +0800
From: "Xialiang (Frank, Network Standard & Patent Dept)" <frank.xialiang@huawei.com>
To: "Hu, Jun (Nokia - US/Mountain View)" <jun.hu@nokia.com>, =?utf-8?B?RmVybmFuZG8gUGVyZcOxw61ndWV6IEdhcmPDrWE=?= <fernando.pereniguez@cud.upct.es>, Linda Dunbar <linda.dunbar@huawei.com>
CC: Roman Danyliw <rdd@cert.org>, idr wg <idr@ietf.org>, "stephane.litkowski@orange.com" <stephane.litkowski@orange.com>, "i2nsf@ietf.org" <i2nsf@ietf.org>, "idr-chairs@ietf.org" <idr-chairs@ietf.org>, =?utf-8?B?R2FicmllbCBMw7NwZXogTWlsbMOhbg==?= <gabilm@um.es>, Yoav Nir <ynir.ietf@gmail.com>, Alvaro Retana <aretana.ietf@gmail.com>, "ipsec@ietf.org WG" <ipsec@ietf.org>, "Benjamin Kaduk" <kaduk@mit.edu>, Rafa Marin Lopez <rafa@um.es>, Paul Wouters <paul@nohats.ca>
Thread-Topic: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration
Thread-Index: AQHU6NlUQrc5k0d4YUC7cHwGpbukl6YoGWbg
Date: Tue, 2 Apr 2019 01:52:16 +0000
Message-ID: <C02846B1344F344EB4FAA6FA7AF481F12CA424B2@dggemm511-mbx.china.huawei.com>
References: <4A95BA014132FF49AE685FAB4B9F17F66B33E27F@sjceml521-mbs.china.huawei.com> <CAB=gXc6aZ2D1K_q3MjVJMEYxEykJO_oxhoSkOEyytOOaa=_ouA@mail.gmail.com> <PR1PR07MB5755052B214EA1243DF2A7EE95550@PR1PR07MB5755.eurprd07.prod.outlook.com>
In-Reply-To: <PR1PR07MB5755052B214EA1243DF2A7EE95550@PR1PR07MB5755.eurprd07.prod.outlook.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_C02846B1344F344EB4FAA6FA7AF481F12CA424B2dggemm511mbxchi_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/idr/Gfth5y8cp59L4Eoq0fel6WXXfA0>
X-Mailman-Approved-At: Tue, 02 Apr 2019 01:58:01 -0700
Subject: [Idr] =?utf-8?b?562U5aSNOiBbSVBzZWNdIHVzaW5nIEJHUCBzaWduYWxpbmcg?= =?utf-8?q?to_achieve_IPsec_Tunnel_configuration_=28draft-hujun-idr-bgp-ip?= =?utf-8?q?sec=29=3A_potential_conflict_with_the_I2NSF=27s_Controller_faci?= =?utf-8?q?litated_IPsec_configuration?=
X-BeenThere: idr@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Inter-Domain Routing <idr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/idr>, <mailto:idr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/idr/>
List-Post: <mailto:idr@ietf.org>
List-Help: <mailto:idr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/idr>, <mailto:idr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Apr 2019 01:52:34 -0000

Hi Jun,
My personal view is no matter which use cases (SDN-based or BGP-based) you are for, the basic goal is to configure/distribute the IPSec parameters between the associated peers, for next step IKEv2 session negotiation. That is why all these related drafts should be aligned in certain way.


发件人: I2nsf [mailto:i2nsf-bounces@ietf.org] 代表 Hu, Jun (Nokia - US/Mountain View)
发送时间: 2019年4月2日 6:22
收件人: Fernando Pereñíguez García <fernando.pereniguez@cud.upct.es>es>; Linda Dunbar <linda.dunbar@huawei.com>
抄送: Roman Danyliw <rdd@cert.org>rg>; idr wg <idr@ietf.org>rg>; stephane.litkowski@orange.com; i2nsf@ietf.org; idr-chairs@ietf.org; Gabriel López Millán <gabilm@um.es>es>; Yoav Nir <ynir.ietf@gmail.com>om>; Alvaro Retana <aretana.ietf@gmail.com>om>; ipsec@ietf.org WG <ipsec@ietf.org>rg>; Benjamin Kaduk <kaduk@mit.edu>du>; Rafa Marin Lopez <rafa@um.es>es>; Paul Wouters <paul@nohats.ca>
主题: Re: [I2nsf] [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Again, Linda, as discussed with you multiple times, my draft is really about extending current draft-ietf-idr-tunnel-encaps<https://datatracker.ietf.org/doc/draft-ietf-idr-tunnel-encaps/> to cover IPsec tunnel and other encryption tunnel like DTLS in next revsion (based on the feedback I got from Prague);
My draft is not intended to address SDN for IPsec use case and it does not require a central controller, and there are use cases where a central controller is not needed or can’t be used, my draft is intended for those cases;

So I really don’t see any conflict here

From: IPsec <ipsec-bounces@ietf.org<mailto:ipsec-bounces@ietf.org>> On Behalf Of Fernando Pere?íguez García
Sent: Monday, April 1, 2019 3:05 PM
To: Linda Dunbar <linda.dunbar@huawei.com<mailto:linda.dunbar@huawei.com>>
Cc: Roman Danyliw <rdd@cert.org<mailto:rdd@cert.org>>; idr wg <idr@ietf.org<mailto:idr@ietf.org>>; stephane.litkowski@orange.com<mailto:stephane.litkowski@orange.com>; i2nsf@ietf.org<mailto:i2nsf@ietf.org>; idr-chairs@ietf.org<mailto:idr-chairs@ietf.org>; Gabriel López Millán <gabilm@um.es<mailto:gabilm@um.es>>; Yoav Nir <ynir.ietf@gmail.com<mailto:ynir.ietf@gmail.com>>; Alvaro Retana <aretana.ietf@gmail.com<mailto:aretana.ietf@gmail.com>>; ipsec@ietf.org<mailto:ipsec@ietf.org> WG <ipsec@ietf.org<mailto:ipsec@ietf.org>>; Benjamin Kaduk <kaduk@mit.edu<mailto:kaduk@mit.edu>>; Rafa Marin Lopez <rafa@um.es<mailto:rafa@um.es>>; Paul Wouters <paul@nohats.ca<mailto:paul@nohats.ca>>
Subject: Re: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Linda,

We have revised draft-hujun-idr-bgp-ipsec and, to the best of our understanding, we do not see any conflict with our draft being discussed in I2NSF. The IPsec attributes configured through BGP are only the peer’s tunnel address and local/remote subnet prefixes (that are used for the traffic selectors).  The rest of the IPsec configuration (AH/ESP, cryptographic algorithms, keys, etc.) are obtained via a “color mapping”, which is something not covered by the draft since it assumes routers are somehow pre-provisioned with this information.

Thus, we do not see this draft is also facing the task of formalizing the complete configuration of an IPsec device. We appreciate any clarification in case we are wrong.

Best regards,

El jue., 28 mar. 2019 a las 16:01, Linda Dunbar (<linda.dunbar@huawei.com<mailto:linda.dunbar@huawei.com>>) escribió:

Just to reiterate the concerns and issues I raised during IDR Thurs session discussion on using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec).
Copy I2NSF WG because there is similar discussion for over a year.
Copy IPsecme WG as the group has many experts on the IPsec configuration.

1.      I2NSF WG has an on-going discussion on Controller facilitated IPsec configuration which has been discussed for over a year.  Even though the I2NSF’s  IPsec Configuration is between Controller and devices, whereas the BGP signaling IPsec Configuration proposed by draft-hujun-idr-bgp-ipsec is between peers, the configuration parameters to the devices are for the same purpose, therefore, should be aligned to avoid future conflicts to the industry.

2.      When using IPsec Tunnel between two peers, usually they are separated by untrusted domain. If Router “A” is allowed to  gets the IPsec tunnel configurations from peers across untrusted domain (instead of the today’s practice of from administrators), then many issues come up, for example:

How can a router “A” trust the Traffic Selection policy from a remote peer B? If the router “A” already has its Traffic Selection policy configured for a specific IPsec tunnel, but different from the Traffic Selection policy from remote peer B, which policy should Route A enforce for the IPsec Tunnel?  If the router “A” doesn’t have Traffic Selection policy specified, there are two remote nodes B & C signaling the “A” with different Traffic Selection policy, what should A do?

3.      RFC5566 only specifies a simple indication of IPsec Encap, but doesn’t do any of the IPsec configuration portion.

As indicated by BESS WG chair, there are multiple drafts addressing IPsec in BESS, IDR, and WGs in Security Area, involved Chairs and ADs may need to agree where is the home for continuing the discussion to avoid future conflicts.

Linda Dunbar
IPsec mailing list

Fernando Pereñíguez García, PhD
Department of Sciences and Informatics
University Defense Center, (CUD), Spanish Air Force Academy, MDE-UPCT
C/ Coronel Lopez Peña, s/n, 30720, San Javier, Murcia - SPAIN
Tel: +34 968 189 946 Fax: +34 968 189 970